UnauthorizedError !

[mbnoimi]

Whenever I call /auth/login-token or /auth/login I get the following response:
Request:

{
  "client_id": "webapp",
  "client_secret": "saqw21!@",
  "username": "super_admin",
  "password": "test123!@#"
}

Response:

{
  "error": {
    "statusCode": 401,
    "name": "UnauthorizedError",
    "message": {}
  }
}

.env:

NODE_ENV=production
LOG_LEVEL=info
DB_HOST=localhost
DB_PORT=5432
DB_USER=postgres
DB_PASSWORD=123654789
DB_DATABASE=todolist
DB_SCHEMA=lbstarter
REDIS_HOST=localhost
REDIS_PORT=6379
REDIS_URL=
REDIS_PASSWORD=
REDIS_DATABASE=0
JWT_SECRET=plmnkoxswqaz
JWT_ISSUER=lb_api
AUDIT_SCHEMA=logs
USER_TEMP_PASSWORD=temp123!@#
GOOGLE_AUTH_URL=
GOOGLE_AUTH_CLIENT_ID=
GOOGLE_AUTH_CLIENT_SECRET=
GOOGLE_AUTH_TOKEN_URL=
GOOGLE_AUTH_CALLBACK_URL=
DEFAULT_ROLE=super_admin

DB structure:

More info:

$ npm ls --prod --depth 0 | grep loopback
loopback4-starter@1.0.1 /home/laptop/loopback4-starter
├── @loopback/boot@1.4.4
├── @loopback/context@1.20.2
├── @loopback/core@1.8.5
├── @loopback/openapi-v3@1.7.0
├── @loopback/repository@1.8.2
├── @loopback/rest-explorer@1.2.5
├── @loopback/rest@1.16.3
├── @loopback/service-proxy@1.2.3
├── loopback-connector-kv-redis@3.0.1
├── loopback-connector-postgresql@3.7.0
├── loopback-connector@4.8.0
├── loopback4-authentication@2.1.1
├── loopback4-authorization@2.3.2
├── loopback4-soft-delete@1.2.0
$

NOTE: I tried to use both options JWT_SECRET=plmnkoxswqaz & JWT_SECRET=plmnkoqazxsw, but I always get the same result.

[mbnoimi]

I tried to set DB_SCHEMA=todolist but I still get the same result.
I suspect there is something wrong in the dependencies, but I couldn't catch it

[samarpan-b]

I'll check and get back to you

[mbnoimi]

I'll check and get back to you

Thanks in advance.

I'm not sure if this related, but I preferred to report it just to take in the consideration.

$ npm audit fix
npm WARN deprecated mkdirp@0.5.4: Legacy versions of mkdirp are no longer supported. Please update to mkdirp 1.x. (Note that the API surface has changed to use Promises in 1.x.)
npm WARN deprecated bcrypt@3.0.8: versions < v5.0.0 do not handle NUL in passwords properly
npm WARN deprecated node-pre-gyp@0.14.0: Please upgrade to @mapbox/node-pre-gyp: the non-scoped node-pre-gyp package is deprecated and only the @mapbox scoped package will recieve updates in the future

added 19 packages, removed 17 packages, changed 37 packages, and audited 717 packages in 10s

5 packages are looking for funding
  run `npm fund` for details

# npm audit report

bcrypt  <5.0.0
Severity: moderate
Inadequate Encryption Strength - https://npmjs.com/advisories/1553
fix available via `npm audit fix --force`
Will install bcrypt@5.0.1, which is a breaking change
node_modules/bcrypt

minimist  <0.2.1 || >=1.0.0 <1.2.3
Prototype Pollution - https://npmjs.com/advisories/1179
fix available via `npm audit fix`
node_modules/rc/node_modules/minimist

2 vulnerabilities (1 low, 1 moderate)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

[mbnoimi]

I tried to update the packages using npm-check-updates but I get the following errors (usually it's working fine LB projects):

$ ncu -u
Upgrading /home/laptop/loopback4-starter/package.json
[====================] 31/31 100%

 @loopback/boot                   ^1.4.4  →     ^3.2.1     
 @loopback/context               ^1.20.2  →    ^3.14.1     
 @loopback/core                   ^1.8.5  →    ^2.14.1     
 @loopback/openapi-v3             ^1.7.0  →     ^5.1.4     
 @loopback/repository             ^1.8.2  →     ^3.4.1     
 @loopback/rest                  ^1.16.3  →     ^9.1.3     
 @loopback/rest-explorer          ^1.2.5  →     ^3.1.0     
 @loopback/service-proxy          ^1.2.3  →     ^3.0.7     
 bcrypt                           ^3.0.6  →     ^5.0.1     
 db-migrate                     ^0.11.11  →   ^0.11.12     
 dotenv                           ^8.0.0  →     ^8.2.0     
 dotenv-extended                  ^2.4.0  →     ^2.9.0     
 lodash                         ^4.17.19  →   ^4.17.21     
 loopback-connector               ^4.8.0  →     ^5.0.1     
 loopback-connector-kv-redis      ^3.0.1  →     ^4.0.0     
 loopback-connector-postgresql    ^3.7.0  →     ^5.3.0     
 loopback4-authentication         ^2.1.1  →     ^4.1.0     
 loopback4-authorization          ^2.3.2  →     ^3.2.0     
 loopback4-soft-delete            ^1.2.0  →     ^3.1.0     
 @loopback/build                  ^2.0.5  →     ^6.2.9     
 @loopback/testlab                ^1.6.3  →    ^3.2.12     
 @types/jsonwebtoken              ^8.3.2  →     ^8.5.0     
 @types/node                    ^10.11.2  →  ^14.14.31     
 eslint                           ^6.0.1  →    ^7.20.0     
 tslint                          ^5.18.0  →    ^5.20.1     
 typescript                       ^3.5.2  →     ^4.2.2     

Run npm install to install new versions.

$ npm install
npm ERR! code ERESOLVE
npm ERR! ERESOLVE unable to resolve dependency tree
npm ERR! 
npm ERR! While resolving: loopback4-starter@1.0.1
npm ERR! Found: @loopback/boot@3.2.1
npm ERR! node_modules/@loopback/boot
npm ERR!   @loopback/boot@"^3.2.1" from the root project
npm ERR! 
npm ERR! Could not resolve dependency:
npm ERR! peer @loopback/boot@"^2.1.2" from loopback4-authentication@4.1.0
npm ERR! node_modules/loopback4-authentication
npm ERR!   loopback4-authentication@"^4.1.0" from the root project
npm ERR! 
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force, or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
npm ERR! 
npm ERR! See /home/laptop/.npm/eresolve-report.txt for a full report.

npm ERR! A complete log of this run can be found in:
npm ERR!     /home/laptop/.npm/_logs/2021-02-27T07_35_37_865Z-debug.log

[samarpan-b]

@mbnoimi I'll try to upgrade this starter kit to latest LB4 versions over this weekend. Or, if you want to contribute, it will be just fine. But seems like you are facing issues. Let me know.

[samarpan-b]

I just merged one PR -> #65 which upgrades some of the LB4 deps. Can you please check now ?

[mbnoimi]

Can you please check now ?

Now, I'm able to see a more detailed error message as following:

{
  "error": {
    "statusCode": 401,
    "name": "UnauthorizedError",
    "message": {
      "length": 177,
      "name": "error",
      "severity": "ERROR",
      "code": "42703",
      "hint": "Perhaps you meant to reference the column \"auth_clients.deleted\".",
      "position": "18",
      "file": "parse_relation.c",
      "line": "3504",
      "routine": "errorMissingColumn"
    }
  }
}

But to be accurate. You didn't update the project to recent packages because I'm still see a differences:

[samarpan-b]

Yes I didn't. This was an old PR from another contributor which I merged.

[samarpan-b]

Can you please check now ?

Now, I'm able to see a more detailed error message as following:

{
  "error": {
    "statusCode": 401,
    "name": "UnauthorizedError",
    "message": {
      "length": 177,
      "name": "error",
      "severity": "ERROR",
      "code": "42703",
      "hint": "Perhaps you meant to reference the column \"auth_clients.deleted\".",
      "position": "18",
      "file": "parse_relation.c",
      "line": "3504",
      "routine": "errorMissingColumn"
    }
  }
}

But to be accurate. You didn't update the project to recent packages because I'm still see a differences:

Now this error means we are trying to reference a non existing column. Can you show me your auth-client.model.ts ?

[mbnoimi]

Can you show me your auth-client.model.ts ?

import {model, property} from '@loopback/repository';
import {IAuthClient} from 'loopback4-authentication';

import {BaseEntity} from './base-entity.model';

@model({
  name: 'auth_clients',
})
export class AuthClient extends BaseEntity implements IAuthClient {
  @property({
    type: 'number',
    id: true,
  })
  id?: number;

  @property({
    type: 'string',
    required: true,
    name: 'client_id',
  })
  clientId: string;

  @property({
    type: 'string',
    required: true,
    name: 'client_secret',
  })
  clientSecret: string;

  @property({
    type: 'string',
    required: true,
  })
  secret: string;

  @property({
    type: 'string',
    name: 'redirect_url',
  })
  redirectUrl?: string;

  @property({
    type: 'array',
    itemType: 'number',
    name: 'user_ids',
  })
  userIds: number[];

  @property({
    type: 'number',
    required: true,
    name: 'access_token_expiration',
  })
  accessTokenExpiration: number;

  @property({
    type: 'number',
    required: true,
    name: 'refresh_token_expiration',
  })
  refreshTokenExpiration: number;

  @property({
    type: 'number',
    required: true,
    name: 'auth_code_expiration',
  })
  authCodeExpiration: number;

  constructor(data?: Partial<AuthClient>) {
    super(data);
  }
}

[samarpan-b]

Ah ! Got it. There has been a major upgrade of soft-delete package here. With that upgrade, you need to add 2 new columns to all tables where you are inheriting from BaseEntity or SoftDeleteEntity class. Columns are deleted_on, deleted_by. Refer to this -> https://github.com/sourcefuse/loopback4-soft-delete/blob/v3.0.0/src/models/soft-delete-entity.ts

Also this changelog -> https://github.com/sourcefuse/loopback4-soft-delete/releases/tag/v3.0.0

[mbnoimi]

There has been a major upgrade of soft-delete package here. With that upgrade, you need to add 2 new columns to all tables

Oops, I'll try to do it manually, but I believe it's time to use LB ORM instead of using db-migrate. Does it?

[mbnoimi]

Do I've to modify the tables and models too?